AgentStack
Browse Sign in
Browse Why AgentStack Sell Docs
Sign in
MCP unreviewed MIT Self-run

Codebase Memory Mcp Pro

mcp-win4r-codebase-memory-mcp-pro · by win4r

Community fork of DeusData/codebase-memory-mcp (MIT) — incremental-reindex CALLS-edge fix + 9 integrated upstream PRs. Pure-C code knowledge-graph MCP server.

No reviews yet
0 installs
23 views
0.0% view→install

Install

$ agentstack add mcp-win4r-codebase-memory-mcp-pro

Open-source listing, not yet scanned by AgentStack. Follow the source repository for install instructions.

Security review

⚠ Flagged

2 finding(s); flagged for manual review. · v0.1.0 How review works →

  • Prompt-injection patterns
  • Secret / credential exfiltration
  • Dangerous shell & filesystem operations
  • Untrusted network calls
  • Known-malicious package signatures
  • high Destructive filesystem operation.
  • high Pipes remote content directly into a shell (remote code execution).

What it can access

  • Network access Used
  • Filesystem access Used
  • Shell / process execution No
  • Environment & secrets Used
  • Dynamic code execution No

From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.

View the full security report →

Reliability & compatibility

Not yet reviewed
0 installs to date
no reviews yet
2mo ago

Declared compatibility

Claude CodeClaude DesktopCursorWindsurf

Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.

Preview Execution monitoring

We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.

How agent discovery & health will work →
Are you the author of Codebase Memory Mcp Pro? Claim this listing to set pricing, connect Stripe payouts, and keep 70% of every sale.
Sign up to claim

About

codebase-memory-mcp-pro

> 🔱 Fork noticecodebase-memory-mcp-pro is a community fork of DeusData/codebase-memory-mcp (MIT License, © 2025 DeusData), maintained by @win4r. It tracks upstream and integrates the following fixes ahead of their upstream merge: > > - Incremental-reindex correctness (#528) — preserve inbound cross-file CALLS edges on incremental re-index; editing a file no longer orphans calls into its symbols. > - Cypher / query_graph — populate node properties carried through WITH aggregation (#465); fix label-filtered traversal silently truncating at 10 rows (#412). > - MCP toolsdetect_changes honors since (#464); definition-preferred name resolution with ambiguity reporting (#466); valid UTF-8 in get_code_snippet (#526). > - Robustness / build — stack-buffer-overflow fix in append_args_json (#475); JSON control-character escaping (#527); preserve ADRs across a full re-index (#539); libgit2 ≥ 1.8 build fix (#512). > - Agent-native enhancements (this fork) — a new explore MCP tool: one call returns the blast-radius (attributed callers + inline fan-in hotspot flags), nearby neighbors (1-hop callees + same-file siblings, so it covers the surrounding area), and the verbatim line-numbered source of the matched symbols grouped by file, with a query_graph/Cypher escape-hatch — built for AI agents to read like a Read. Plus idiomatic Swift type kindsstruct/enum/actor are distinct graph labels (Struct/Enum/Actor) instead of all being lumped as Class, and Swift enum cases are extracted as distinct EnumCase nodes (including multi-name case a, b, c lines) — and a Swift enum-static dedup fix (an enum's static funcs are no longer double-emitted as both a Method and a Function node). > - Cypher aggregation fix (this fork) — a non-aggregate function mixed with an aggregate (e.g. RETURN type(r), count(*)) now groups by the function value (one row per edge type) instead of collapsing every row into a single group. > - detect_changes blast radius (this fork) — the depth parameter now produces a transitive caller blast radius: impacted_symbols includes callers up to depth hops, each tagged with hop + transitive, alongside a deduped impacted_count. > > All credit for the original engine belongs to DeusData. License unchanged — see [LICENSE](LICENSE).

🛠️ Build this fork from source

This fork ships no prebuilt release binaries — build the integrated binary yourself. Pure C, Apple clang / gcc, zero external runtime dependencies:

git clone https://github.com/win4r/codebase-memory-mcp-pro.git
cd codebase-memory-mcp-pro
./scripts/build.sh          # → build/c/codebase-memory-mcp   (reports version: dev)

The first build compiles all 158 vendored tree-sitter grammars (a few minutes); for iterative rebuilds make -j -f Makefile.cbm cbm is much faster. The macOS libgit2 ≥ 1.8 build fix (#512) is already integrated, so a Homebrew libgit2 compiles cleanly.

Install on your PATH and wire it into Claude Code as an MCP server:

cp build/c/codebase-memory-mcp ~/.local/bin/

# stdio MCP server, available in all projects:
claude mcp add codebase-memory -s user -- ~/.local/bin/codebase-memory-mcp
# tools: explore, index_repository, query_graph, trace_path, get_code_snippet, detect_changes … (15 total)

Confirm the integrated fixes are live (e.g. #465 — node properties survive a WITH aggregation, which returns blank on stock upstream):

codebase-memory-mcp cli index_repository '{"repo_path":"/path/to/repo"}'
codebase-memory-mcp cli query_graph '{"project":"","query":"MATCH (a)-[:CALLS]->(b) WITH b, count(a) AS c RETURN b.file_path, c LIMIT 1"}'
# a non-empty file_path means you are running the cherry-picked build

> ⚠️ Do not run the binary's update subcommand — it pulls the official upstream release and overwrites this integrated build. Re-run ./scripts/build.sh to update instead.


The upstream README follows.

[](https://github.com/DeusData/codebase-memory-mcp/releases/latest) [](LICENSE) [](https://github.com/DeusData/codebase-memory-mcp/actions/workflows/dry-run.yml) [](https://github.com/DeusData/codebase-memory-mcp) [](https://github.com/DeusData/codebase-memory-mcp) [](#hybrid-lsp) [](https://github.com/DeusData/codebase-memory-mcp) [](https://github.com/DeusData/codebase-memory-mcp) [](https://github.com/DeusData/codebase-memory-mcp/releases/latest) [](https://scorecard.dev/viewer/?uri=github.com/DeusData/codebase-memory-mcp) [](https://slsa.dev) [](https://github.com/DeusData/codebase-memory-mcp/releases/latest) [](https://arxiv.org/abs/2603.27277)

The fastest and most efficient code intelligence engine for AI coding agents. Full-indexes an average repository in milliseconds, the Linux kernel (28M LOC, 75K files) in 3 minutes. Answers structural queries in under 1ms. Ships as a single static binary for macOS, Linux, and Windows — download, run install, done.

High-quality parsing through tree-sitter AST analysis across all 158 languages, enhanced with [Hybrid LSP semantic type resolution](#hybrid-lsp) for Python, TypeScript / JavaScript / JSX / TSX, PHP, C#, Go, C, C++, Java, Kotlin, and Rust — producing a persistent knowledge graph of functions, classes, call chains, HTTP routes, and cross-service links. 14 MCP tools. Zero dependencies. Plug and play across 11 coding agents.

> Research — The design and benchmarks behind this project are described in the preprint Codebase-Memory: Tree-Sitter-Based Knowledge Graphs for LLM Code Exploration via MCP (arXiv:2603.27277). Evaluated across 31 real-world repositories: 83% answer quality, 10× fewer tokens, 2.1× fewer tool calls vs. file-by-file exploration.

> Security & Trust — This tool reads your codebase and writes to your agent configuration files. That is what it is designed to do. If you prefer to audit before running, the full source is here — every release binary is signed, checksummed, and scanned by 70+ antivirus engines. All processing happens 100% locally; your code never leaves your machine. Found a security issue? We want to know — see [SECURITY.md](SECURITY.md). Security is Priority #1 for us.

Built-in 3D graph visualization (UI variant) — explore your knowledge graph at localhost:9749

Why codebase-memory-mcp

  • Extreme indexing speed — Linux kernel (28M LOC, 75K files) in 3 minutes. RAM-first pipeline: LZ4 compression, in-memory SQLite, fused Aho-Corasick pattern matching. Memory released after indexing.
  • Plug and play — single static binary for macOS (arm64/amd64), Linux (arm64/amd64), and Windows (amd64). No Docker, no runtime dependencies, no API keys. Download → install → restart agent → done.
  • 158 languages — vendored tree-sitter grammars compiled into the binary. Nothing to install, nothing that breaks.
  • 120x fewer tokens — 5 structural queries: ~3,400 tokens vs ~412,000 via file-by-file search. One graph query replaces dozens of grep/read cycles.
  • 11 agents, one commandinstall auto-detects Claude Code, Codex CLI, Gemini CLI, Zed, OpenCode, Antigravity, Aider, KiloCode, VS Code, OpenClaw, and Kiro — configures MCP entries, instruction files, and pre-tool hooks for each.
  • Built-in graph visualization — 3D interactive UI at localhost:9749 (optional UI binary variant).
  • Infrastructure-as-code indexing — Dockerfiles, Kubernetes manifests, and Kustomize overlays indexed as graph nodes with cross-references. Resource nodes for K8s kinds, Module nodes for Kustomize overlays with IMPORTS edges to referenced resources.
  • 14 MCP tools — search, trace, architecture, impact analysis, Cypher queries, dead code detection, cross-service HTTP linking, ADR management, and more.

Quick Start

One-line install (macOS / Linux):

curl -fsSL https://raw.githubusercontent.com/DeusData/codebase-memory-mcp/main/install.sh | bash

With graph visualization UI:

curl -fsSL https://raw.githubusercontent.com/DeusData/codebase-memory-mcp/main/install.sh | bash -s -- --ui

Windows (PowerShell):

# 1. Download the installer
Invoke-WebRequest -Uri https://raw.githubusercontent.com/DeusData/codebase-memory-mcp/main/install.ps1 -OutFile install.ps1

# 2. (Optional but recommended) Inspect the script
notepad install.ps1

# 3. Run it
.\install.ps1

Options: --ui (graph visualization), --skip-config (binary only, no agent setup), --dir= (custom location).

Restart your coding agent. Say "Index this project" — done.

Manual install

  1. Download the archive for your platform from the latest release:
  • codebase-memory-mcp--.tar.gz (macOS/Linux) or .zip (Windows) — standard
  • codebase-memory-mcp-ui--.tar.gz / .zip — with graph visualization
  1. Extract and install (each archive includes install.sh or install.ps1):

macOS / Linux: ``bash tar xzf codebase-memory-mcp-*.tar.gz ./install.sh ``

Windows (PowerShell): ``powershell Expand-Archive codebase-memory-mcp-windows-amd64.zip -DestinationPath . .\install.ps1 ``

  1. Restart your coding agent.

The install command automatically strips macOS quarantine attributes and ad-hoc signs the binary — no manual xattr/codesign needed.

The install command auto-detects all installed coding agents and configures MCP server entries, instruction files, skills, and pre-tool hooks for each.

Graph Visualization UI

If you downloaded the ui variant:

codebase-memory-mcp --ui=true --port=9749

Open http://localhost:9749 in your browser. The UI runs as a background thread alongside the MCP server — it's available whenever your agent is connected.

Auto-Index

Enable automatic indexing on MCP session start:

codebase-memory-mcp config set auto_index true

When enabled, new projects are indexed automatically on first connection. Previously-indexed projects are registered with the background watcher for ongoing git-based change detection. Configurable file limit: config set auto_index_limit 50000.

Keeping Up to Date

codebase-memory-mcp update

The MCP server also checks for updates on startup and notifies on the first tool call if a newer release is available.

Uninstall

codebase-memory-mcp uninstall

Removes all agent configs, skills, hooks, and instructions. Does not remove the binary or SQLite databases.

Features

Graph & analysis

  • Architecture overview: get_architecture returns languages, packages, entry points, routes, hotspots, boundaries, layers, and clusters in a single call
  • Architecture Decision Records: manage_adr persists architectural decisions across sessions
  • Louvain community detection: Discovers functional modules by clustering call edges
  • Git diff impact mapping: detect_changes maps uncommitted changes to affected symbols with risk classification
  • Call graph: Resolves function calls across files and packages (import-aware, type-inferred)
  • Dead code detection: Finds functions with zero callers, excluding entry points
  • Cypher-like queries: MATCH (f:Function)-[:CALLS]->(g) WHERE f.name = 'main' RETURN g.name

Search

  • Semantic search (semantic_query): vector search across the entire graph, powered by bundled Nomic nomic-embed-code embeddings (40K tokens, 768d int8) compiled into the binary — no API key, no Ollama, no Docker. 11-signal combined scoring (TF-IDF, RRI, API/Type/Decorator signatures, AST profiles, data flow, Halstead-lite, MinHash, module proximity, graph diffusion).
  • BM25 full-text search via SQLite FTS5 with cbm_camel_split tokenizer (camelCase / snake_case aware)
  • Structural search (search_graph): regex name patterns, label filters, min/max degree, file scoping
  • Code search (search_code): graph-augmented grep over indexed files only

Cross-service linking

  • HTTP route ↔ call-site matching with confidence scoring
  • gRPC, GraphQL, tRPC service detection with protobuf Route extraction
  • Channel detection (EMITS / LISTENS_ON) for Socket.IO, EventEmitter, and generic pub-sub patterns across 8 languages with constant resolution

Cross-repo intelligence

  • CROSS_* edges link nodes across multiple repos indexed under the same store
  • Multi-galaxy 3D UI layout for cross-repo architecture visualization
  • Cross-repo architecture summary combining services, routes, and dependencies across the indexed fleet

Edge types (selected)

  • CALLS, IMPORTS, DEFINES, IMPLEMENTS, INHERITS
  • HTTP_CALLS, ASYNC_CALLS (cross-service)
  • EMITS, LISTENS_ON (channels)
  • DATA_FLOWS with arg-to-param mapping + field access chains
  • SIMILAR_TO (MinHash + LSH near-clone detection, Jaccard scored)
  • SEMANTICALLY_RELATED (vocabulary-mismatch, same-language, score ≥ 0.80)

Indexing pipeline

  • 158 vendored tree-sitter grammars compiled into the binary
  • Generic package / module resolution — bare specifiers like @myorg/pkg, github.com/foo/bar, use my_crate::foo resolved via manifest scanning (package.json, go.mod, Cargo.toml, pyproject.toml, composer.json, pubspec.yaml, pom.xml, build.gradle, mix.exs, *.gemspec)
  • Infrastructure-as-code indexing — Dockerfiles, Kubernetes manifests, Kustomize overlays as graph nodes
  • [Hybrid LSP semantic type resolution](#hybrid-lsp) for Python, TypeScript / JavaScript / JSX / TSX, PHP, C#, Go, C, C++, Java, Kotlin, and Rust — a lightweight C implementation of language type-resolution algorithms, structurally inspired by and compatible with major language servers including tsserver / typescript-go, pyright, gopls, Roslyn, Eclipse JDT, and rust-analyzer (parameter binding, return-type inference, generic substitution, JSX component dispatch, JSDoc inference for plain JS files, namespace + trait + late-static-binding resolution for PHP, file-scoped namespaces + records + LINQ method syntax for C#, class-hierarchy + overload + lambda resolution for Java, extension-function + scope-function resolution for Kotlin, trait-method + UFCS resolution for Rust)
  • RAM-first pipeline: LZ4 compression, in-memory SQLite, single dump at end. Memory released after.

Distribution & operation

  • Single static binary, zero infrastructure: SQLite-backed, persists to ~/.cache/codebase-memory-mcp/
  • Auto-sync: Background watcher detects file changes and re-indexes automatically
  • Route nodes: REST endpoints are first-class graph entities
  • CLI mode: codebase-memory-mcp cli search_graph '{"name_pattern": ".*Handler.*"}'
  • Available on: npm, PyPI, Homebrew, Scoop, Winget, Chocolatey, AUR, go install

Team-Shared Graph Artifact

Commit a single compressed file to your repo and your teammates skip the reindex.

.codebase-memory/graph.db.zst is a zstd-compressed snapshot of the knowledge graph that lives next to your source. When you index, the artifact is written or refreshed; when

Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

Install and usage instructions live in the source repository linked above.

Reviews

No reviews yet, be the first.

Versions

  • v0.1.0 Imported from the upstream source.